Kentico Xperience CVE-2026-105046

Exploitation requires an authenticated session to the Kentico Xperience 13 administration API with at least low-privilege access (CVSS PR:L), and an affected version prior to 13.0.216. The specific condition is that the administration API endpoints perform no object-level (per-object) authorization check, so any authenticated admin user can request objects owned by or scoped to other users. Limiting factors: valid administration credentials are mandatory (no anonymous/unauthenticated path per PR:L), the impact is confined to information disclosure (C:L, I:N, A:N - no data modification or availability effect), and installations patched to 13.0.216 or later are not affected.

This is a moderate-severity, low-real-risk issue by current signals. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) indicates a network-reachable but privilege-requiring (PR:L) flaw with confidentiality-only impact (C:L, I:N, A:N) - consistent with a broken object-level authorization (BOLA/IDOR-style) weakness, CWE-425, that lets an already-authenticated low-privilege administration user read objects they should not. No EPSS score, no CISA KEV listing, and no POC are present in the input, so there is no evidence of active or probable exploitation. The main mitigating factor is PR:L: an attacker must already hold valid (if low-privilege) credentials to the administration API, which limits this to insider or post-compromise scenarios rather than mass internet-facing exploitation. Note the KEV/EPSS/POC fields are simply absent rather than conflicting, so no signals contradict each other; the picture is internally consistent - a genuine but low-urgency authorization gap. Patch availability from the vendor makes remediation straightforward and argues for routine, not emergency, prioritization.

A low-privilege authenticated user of the Kentico Xperience 13 administration interface sends direct requests to administration API endpoints referencing object identifiers belonging to other users or sections. Because object-level authorization checks are missing, the endpoint returns data the user is not authorized to view, resulting in disclosure of sensitive administrative information. No public exploit code is identified at time of analysis, and the network attack vector with low complexity makes the requests trivial to craft once credentials are held.